fix: update brace-expansion lockfile entry

[cesarenaldi]

Updates the lockfile to resolve GHSA-jxxr-4gwj-5jf2 / CVE-2026-45149 for brace-expansion.

brace-expansion is pulled in through dev tooling only:

rimraf -> glob -> minimatch -> brace-expansion

This is not part of the published SDK runtime dependency graph, so SDK consumers are not exposed through @polymarket/client. The practical risk is limited to maintainer/dev-tooling usage where an attacker can control brace-expansion input.

I kept this intentionally lockfile-only:

• brace-expansion 5.0.5 -> 5.0.6
• no package manifest changes
• no broader dependency refresh

Verification:

• pnpm install --frozen-lockfile
• OSV no longer reports brace-expansion
• pnpm lint
• pnpm typecheck